Security Operations Center Analyst

Role Purpose

The SOC Analyst Level 2 is responsible for advanced investigation, incident analysis, threat hunting, response coordination, and technical escalation within the SOC.

The L2 Analyst acts as the primary escalation point for L1 Analysts and is responsible for validating complex incidents, determining root cause and scope, recommending or coordinating containment actions, and improving SOC detection capabilities.

Key Responsibilities

1. Advanced Incident Investigation

• Perform deep-dive analysis of escalated security incidents.
• Correlate events across multiple security technologies and log sources.
• Determine attack scope, affected users, systems, and business services.
• Analyze attacker behavior and map activities to relevant attack techniques.

2. Incident Response and Coordination

• Lead technical investigation of medium and high-severity incidents.
• Recommend containment, eradication, and recovery actions.
• Coordinate with IT, infrastructure, cloud, application, and client teams.
• Support incident communications and provide technical updates.

3. Threat Hunting

• Conduct proactive threat hunting using logs, telemetry, IOCs, and behavioral indicators.
• Identify suspicious activity not detected by existing security controls.
• Develop hypotheses and investigative queries.

4. Detection Engineering

• Tune SIEM and security analytics rules.
• Reduce false positives while maintaining detection coverage.
• Recommend and develop new detection use cases.
• Identify gaps in log sources and monitoring coverage.

5. Malware and IOC Analysis

• Analyze suspicious files, processes, URLs, domains, IP addresses, and hashes.
• Investigate persistence, lateral movement, credential abuse, and suspicious command execution.
• Use threat intelligence to validate potential malicious activity.

6. L1 Mentoring and Quality Assurance

• Provide guidance and technical support to L1 Analysts.
• Review escalated cases for quality and completeness.
• Conduct case reviews and knowledge-sharing sessions.
• Improve SOC playbooks and investigation procedures.

Required Qualifications

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field, or equivalent experience.
• Typically 3–5+ years of cybersecurity, SOC, incident response, security engineering, or threat hunting experience.
• Hands-on experience investigating security incidents.
• Experience with SIEM and EDR/XDR platforms.
• Strong understanding of networking, Windows, Linux, Active Directory, cloud, and identity security.
• Experience in a Managed SOC or MSSP environment is highly desirable.